Loading...
Skip to main content
GeekWala

CVE-2026-50194 — Vulnerability in Steeltoe.Management.EndpointCore...

HIGH

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Published July 2, 2026Updated July 2, 2026Source: osv

Summary

### Summary When Steeltoe management endpoints are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the actual network socket port. ### Impact An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request. ### Affected configuration - The application's public port is accessible over from the network. - `Management:Endpoints:Port` is configured to a value different from the application's main listener port. - The request scheme matches `Management:Endpoints:SslEnabled`. For example, `http` when `SslEnabled` is `false` (the default), or `https` when `SslEnabled` is `true`. ### Mitigations If an immediate upgrade to a patched version is not possible: - Add explicit ASP.NET Core authorization (`RequireAuthorization`) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation. - Configure the reverse proxy or load balancer to enforce the `Host` header value and prevent clients from setting an arbitrary port.

Advisory Timeline

  • First published July 2, 2026 (102 days ago).
  • Last revised July 2, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update Steeltoe.Management.EndpointCore to 3.4.0 or later
dotnet add package Steeltoe.Management.EndpointCore --version 3.4.0
NuGet
Update Steeltoe.Management.Endpoint to 4.2.0 or later
dotnet add package Steeltoe.Management.Endpoint --version 4.2.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: nuget (2).

PackageEcosystemAffectedFixed In
Steeltoe.Management.EndpointCore
nuget
3.2.2, 3.2.3, 3.2.4, 3.2.5 (+4 more)3.4.0
Steeltoe.Management.Endpoint
nuget
1.1.0, 1.1.0-rc3, 4.0.0, 4.0.0-beta1 (+2 more)4.2.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.2 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

Frequently Asked Questions

What is CVE-2026-50194?
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.2/10).
How do I check if my project is affected by CVE-2026-50194?
CVE-2026-50194 affects Steeltoe.Management.EndpointCore and Steeltoe.Management.Endpoint. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-50194 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.2

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-58f6-6rj2-3v8r

Related CVEs

  • CVE-2026-106112
    HIGH

    ImageSharp: ICC LUT16 output channel count can write beyond Vector4

  • CVE-2026-106115
    HIGH

    ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

  • CVE-2026-50200
    HIGH

    Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

  • CVE-2026-50201
    MEDIUM

    Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

  • CVE-2026-75523
    MEDIUM

    Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies